Summary
Vendure: Shop API list queries can return non-public entities when filterOperator is OR
Advisory details
The Shop API products, collections and facets queries inject a mandatory filter to restrict results to publicly-visible entities (Product.enabled = true, Collection.isPrivate = false, Facet.isPrivate = false). This injected guard was combined with the caller-supplied filter using the caller-controlled filterOperator. When a caller sets filterOperator: OR, the guard is OR-combined instead of AND-combined, so a caller can retrieve disabled products and private collections/facets by supplying a predicate that matches them.
Impact
Exposure of catalog entities intended to be hidden from the Shop API. The Shop API is publicly accessible, so no authentication is required.
Patches
The injected guard is now always AND-combined with the caller-supplied filter, regardless of filterOperator.
Workarounds
None other than upgrading.
References
Related vulnerabilities
All Supply chain →- MEDIUMGHSA-8wvg-r2j4-3737
Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint
- MEDIUMGHSA-3hc7-r24j-rpwc
Vikunja: Cross-project task disclosure through subtask expansion
- MEDIUMCVE-2026-107842
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
- MEDIUMCVE-2026-91981
Vikunja: Link-share token can enumerate users through the v2 API
- MEDIUMCVE-2026-91980
Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project
- HIGHCVE-2026-91985
Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level